Abstract: In some implementations, a computing device can determine the similarity of binary executables. For example, the computing device can receive an application, including a binary executable. The computing device can generate function signatures for the functions called within the binary executable. The computing device can generate a locality sensitive hash value for the application based on the function signatures. The computing device can group applications based on the locality sensitive hash value generated for each application. The computing device can compare the function signatures of the binary executables of the applications within a group to determine the similarity of the applications. If two applications have binary executables that are over a threshold percentage of similarity, the two applications can be identified as clones of each other.

Abstract: In some implementations, a computing device can determine the similarity of binary executables. For example, the computing device can receive an application, including a binary executable. The computing device can generate function signatures for the functions called within the binary executable. The computing device can generate a locality sensitive hash value for the application based on the function signatures. The computing device can group applications based on the locality sensitive hash value generated for each application. The computing device can compare the function signatures of the binary executables of the applications within a group to determine the similarity of the applications. If two applications have binary executables that are over a threshold percentage of similarity, the two applications can be identified as clones of each other.

Abstract: Disclosed is a system and method for setting breakpoints (BPs) that cannot be detected by code being debugged, e.g., to trap transparently at any instruction. The disclosed system and method permits execution tracing and instrumentation of binaries, including malware. The system and method can be used to analyze benign software also, e.g., software obfuscated for anti-reverse-engineering. An invisible breakpoint (IBP) is not detectable by the “guest,” the program being debugged. Hardware virtualization is used to split the code and data views of the program's text segment(s).

Abstract: Disclosed is a system and method for setting breakpoints (BPs) that cannot be detected by code being debugged, e.g., to trap transparently at any instruction. The disclosed system and method permits execution tracing and instrumentation of binaries, including malware. The system and method can be used to analyze benign software also, e.g., software obfuscated for anti-reverse-engineering. An invisible breakpoint (IBP) is not detectable by the “guest,” the program being debugged. Hardware virtualization is used to split the code and data views of the program's text segment(s).

Abstract: Disclosed is a system and method for removing binary components from machine-language programs or inserting binary components into such programs. The method may include modifying a code sequence of the program (inserting or removing instructions), analyzing the program to determine one or more adjustment(s) to address(es) (of code or data references, direct or indirect) in the program, and modifying operand(s) of one or more instruction(s) in the program to reflect corresponding one(s) of the adjustment(s) (e.g., change offsets or add displacements to register-indirect accesses).